Grype
7.4#3 in software composition analysis softwareFree planFree planLinuxmacOSSelf-hostedWindows
VisitGrype vs ts-scan
What both publish
| Fact | Grype | ts-scan |
|---|---|---|
| CI/CD integration | Grype can run directly in build pipelines or through Anchore's Container Scan GitHub Action, with pipelines able to fail on severity thresholds. | The maker says ts-scan integrates into GitHub workflows as a GitHub Action. |
| Headquarters | Santa Barbara, California, United States | Frankfurt am Main, Germany |
| Installation | Official binaries and source archives are provided for Linux, macOS and Windows, with installer-script, Docker and package-manager options. | The maker documents installation with pip and says Docker images and source builds are available in the repository. |
| Intended users | The project documentation describes individual package scanning as useful for lightweight vulnerability checks and compliance scanning of specific dependencies. | The maker describes ts-scan as an open-source CLI scanner for use in CI/CD pipelines to identify dependencies and create SBOMs. |
| License | The project is released under the Apache-2.0 License. | The repository identifies ts-scan as Python software under the Apache-2.0 license. |
| Purpose | Grype scans container images, filesystems, and SBOMs for known vulnerabilities. | ts-scan scans software dependencies and generates a software bill of materials (SBOM). |
| SBOM formats | Grype accepts Syft JSON, SPDX JSON/XML/tag-value and CycloneDX JSON/XML SBOMs. | It exports SBOMs in SPDX and CycloneDX formats. |
Grype plans
- GrypeFree
- Grype open-source scannerFree
ts-scan plans
No prices published.
Pick Grype if…
Grype suits developers and teams checking packages, images, filesystems, or SBOMs for known vulnerabilities. Its individual-package scanning is also intended for lightweight checks and compliance reviews of specific dependencies.
Pick ts-scan if…
You want what its maker publishes above — check its page for the details.